Thread Info
  • State Not Answered
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 11 replies
  • Subscribers 30 subscribers
  • Views 13024 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

What is the best way to accelerate SNORT/IDS/IPS? It's cutting my bandwidth in half?!

Pickle Rick

I am on Gigabit FIOS symmetric.  W/O IPS/IDS/SNORT I get about 890 Mbit/s once I turn on IPS/IDS/SNORT regardless on how many rules I have there I get between 360 to 390 Mbit/s (via speedtest by Ookla...same test for 890) the range is respective from LINUX only rules to the WHOLE SHEBANG EVERYTHING ON  so in the end I am getting about half the download speed by just turning the IPS/IDS/SNORT on....what the hell?!!!  There must be a way to optimize it...I mean come on LINUX vs EVERYTHING and I only gain 30 Mbit/s?!



This thread was automatically locked due to age.
Parents
  • 0

    Hi Rick,

    what error values are reported in the IPS settings and do your logs/reports show any rule that is causing the slowdown?

    What functions of IPS do you enable? There is another thread that recommends not to use the TCP flood after setup.

    Ian

  • 0 in reply to rfcat_vk

    Before I dive too deep what is the best place and best way to report these?  I have bunch of logs but ummm I want to parse them the best that is receptive to the community.

  • 0 in reply to Pickle Rick

    Hi Rick,

    as a home user this forum is the only place within the Sophos environment. There are more than likely user forums on the SNORT web site that might be able to assist?

    A screenshot of your IPS page, might lead to some others joining in the discussion?

    Some tips from the UTM snort settings, you need to possibly run two test sessions because snort is a little slow in ramping up. If you have power saving enabled snort doesn't ramp up unless there are a couple of users pulling data. Snort is still a single threaded application with a lot of XG and UTM users anticipating the move to a multi-threaded snort.

    Ian

Reply
  • 0 in reply to Pickle Rick

    Hi Rick,

    as a home user this forum is the only place within the Sophos environment. There are more than likely user forums on the SNORT web site that might be able to assist?

    A screenshot of your IPS page, might lead to some others joining in the discussion?

    Some tips from the UTM snort settings, you need to possibly run two test sessions because snort is a little slow in ramping up. If you have power saving enabled snort doesn't ramp up unless there are a couple of users pulling data. Snort is still a single threaded application with a lot of XG and UTM users anticipating the move to a multi-threaded snort.

    Ian

Children